wlan: Add sanity check to limit mgmt frames data len
Currently the frameLen in Rx pkt meta is not checked for
upper bound in peHandleMgmtFrame.
Add sanity check to drop the packet if frameLen is
greater than 2000 bytes. Also add upper bound check for
frameLen in limProcessAuthFrame function.
Change-Id: Id8d80f892c18d044896224c22b21f667ee30eb6b
CRs-Fixed: 2146331
diff --git a/CORE/MAC/src/pe/lim/limApi.c b/CORE/MAC/src/pe/lim/limApi.c
index 64b0bd6..d8137ff 100644
--- a/CORE/MAC/src/pe/lim/limApi.c
+++ b/CORE/MAC/src/pe/lim/limApi.c
@@ -1396,6 +1396,7 @@
vos_pkt_t *pVosPkt;
VOS_STATUS vosStatus;
v_U8_t *pRxPacketInfo;
+ tANI_U16 frameLen;
pVosPkt = (vos_pkt_t *)vosBuff;
if (NULL == pVosPkt)
@@ -1419,6 +1420,12 @@
return VOS_STATUS_E_FAILURE;
}
+ frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
+ if (frameLen > WDA_MAX_MGMT_MPDU_LEN) {
+ PELOG1(limLog(pMac, LOG1, FL("Dropping frame of len %d"), frameLen));
+ vos_pkt_return_packet(pVosPkt);
+ return VOS_STATUS_E_FAILURE;
+ }
//
// The MPDU header is now present at a certain "offset" in
diff --git a/CORE/MAC/src/pe/lim/limProcessAuthFrame.c b/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
index 848dbc5..321658c 100644
--- a/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAuthFrame.c
@@ -287,7 +287,8 @@
goto free;
}
- if (frameLen < LIM_ENCR_AUTH_BODY_LEN_SAP)
+ if ((frameLen < LIM_ENCR_AUTH_BODY_LEN_SAP) ||
+ (frameLen > LIM_ENCR_AUTH_BODY_LEN))
{
// Log error
limLog(pMac, LOGE,
diff --git a/CORE/WDA/inc/wlan_qct_wda.h b/CORE/WDA/inc/wlan_qct_wda.h
index 997c80d..25ee44f 100644
--- a/CORE/WDA/inc/wlan_qct_wda.h
+++ b/CORE/WDA/inc/wlan_qct_wda.h
@@ -795,6 +795,8 @@
#define WLANWDA_HO_IS_AN_AMPDU 0x4000
#define WLANWDA_HO_LAST_MPDU_OF_AMPDU 0x400
+#define WDA_MAX_MGMT_MPDU_LEN 2000
+
/* WDA_IS_RX_AN_AMPDU ********************************************************/
# define WDA_IS_RX_AN_AMPDU(pRxMeta) \
( ((WDI_DS_RxMetaInfoType*)(pRxMeta))->rxpFlags & WLANWDA_HO_IS_AN_AMPDU )